See your website the way an attacker does.
Paste your address. In about twenty seconds you'll know whether your certificate, files and email are protected — explained in plain language, with the fix for each.
- Looking up the domain
- Testing the HTTPS certificate
- Reading security headers
- Checking for exposed files
- Checking email spoofing protection
- Writing your report
What Kestrel looks at
- Certificate validity and expiry date
- HTTP to HTTPS redirect
- Outdated TLS versions
- Exposed .env, .git and backup files
- phpinfo and server-status pages
- WordPress version leaks and XML-RPC
- Missing HSTS and Content-Security-Policy
- Clickjacking and MIME-sniffing protection
- Cookie Secure and HttpOnly flags
- Forms that submit over plain HTTP
- Mixed content on secure pages
- SPF and DMARC email spoofing protection